DNS spoofing questions

No, it is an old clear text protocol: client connect on tcp port 43, ask a question, for instance example.com and get an answer without any predefine syntax. The answer can be go ask to this server (with no standardized syntax, it's up to the whois client to understand this whois server) so you can be redirected from the whois.iana.org whois database to a tld database.